nilsandClaude
3ab8ff8dd7
ci / docker (push) Failing after 52s
Rust (axum + sqlx) API and worker sharing a Postgres-backed job queue (SKIP LOCKED, heartbeat, reaper, typed statuses), S3 storage with derived keys and a fully private bucket, OIDC photographer login with per-request allowlist checks, client share links with argon2 passwords and lockout, cookie-based image authorization with sliding expiry, hand-rolled spec-compliant streaming ZIP downloads with exact Content-Length, React + Vite gallery frontend, single Docker image, Helm chart for external S3 + Postgres, and Gitea CI. Co-Authored-By: Claude <noreply@anthropic.com>
67 lines
1.5 KiB
YAML
67 lines
1.5 KiB
YAML
image:
|
|
repository: ghcr.io/CHANGE-ME/photos
|
|
tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
api:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
worker:
|
|
replicas: 1
|
|
concurrency: 2
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 2Gi
|
|
|
|
# External base URL of the app; the OIDC redirect URI is <publicUrl>/api/auth/callback
|
|
publicUrl: https://photos.example.com
|
|
|
|
config:
|
|
s3:
|
|
# Leave endpoint empty for AWS S3; set for MinIO/Ceph/etc.
|
|
endpoint: ""
|
|
region: us-east-1
|
|
bucket: photos
|
|
forcePathStyle: false
|
|
oidcIssuer: https://auth.example.com
|
|
# Comma-separated photographer emails allowed to sign in
|
|
allowedEmails: you@example.com
|
|
logLevel: info,sqlx=warn
|
|
|
|
# Sensitive settings. Either reference an existing Secret containing the keys
|
|
# DATABASE_URL, S3_ACCESS_KEY, S3_SECRET_KEY, OIDC_CLIENT_ID,
|
|
# OIDC_CLIENT_SECRET, SESSION_SECRET — or inline the values and the chart
|
|
# creates the Secret for you.
|
|
secrets:
|
|
existingSecret: ""
|
|
databaseUrl: ""
|
|
s3AccessKey: ""
|
|
s3SecretKey: ""
|
|
oidcClientId: ""
|
|
oidcClientSecret: ""
|
|
sessionSecret: ""
|
|
|
|
service:
|
|
port: 80
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
host: photos.example.com
|
|
annotations:
|
|
# Raw uploads are large; disable nginx's body size limit.
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
|
|
tls:
|
|
enabled: true
|
|
secretName: photos-tls
|